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Abstract 



This paper gives the first formal treatment of a quantum analogue of multi-prover interactive 
^ I proof systems. It is proved that the class of languages having quantum multi-prover interactive 

proof systems is necessarily contained in NEXP, under the assumption that provers are allowed to 
share at most polynomially many prior-entangled qubits. This implies that, in particular, if provers 
' do not share any prior entanglement with each other, the class of languages having quantum multi- 

^ I prover interactive proof systems is equal to NEXP. Related to these, it is shown that, in the case 

a prover does not have his private qubits, the class of languages having quantum single-prover 
interactive proof systems is also equal to NEXP. 



1 Introduction 

After Deutsch gave the first formal treatment of quantum computation, a number of papers 
have provided evidence that quantum computation has much more power than classical computa- 
tion for solving certain computational tasks, including notable Shor's integer factoring algorithm [,VA\ . 
Watrous IHSl showed that it might be also the case for single-prover interactive proof systems, by 
constructing a constant-round quantum interactive protocol for a PSPACE-complete language, which 
is impossible for classical interactive proof systems unless the polynomial-time hierarchy collapses to 
AM [H . A natural question to ask is how strong a quantum analogue of multi-prover interactive 
proof systems is. This paper gives the first step for this question, by proving that the class of languages 
having quantum multi-prover interactive proof systems is necessarily contained in non-deterministic 



1 



exponential time (NEXP), under the assumption that provers are ahowed to share at most polynomi- 
ally many prior-entangled qubits. This might even suggest that, under such an assumption, quantum 
multi-prover interactive proof systems are weaker than classical ones, since Cleve |il2) reported that a 
pair of provers sharing polynomially many entangled qubits can in some sense cheat a classical verifier. 

Interactive proof systems were introduced by Babai 4 and Goldwasser, Micali, and Rackoff |18j . 
An interactive proof system consists of an interaction between a computationally unbounded prover 
and a polynomial-time probabilistic verifier. The prover attempts to convince the verifier that a given 
input string satisfies some property, while the verifier tries to verify the validity of the assertion of 
the prover. A language L is said to have an interactive proof system if there exists a verifier V such 
that (i) in the case the input is in L, there exists a prover P that can convince V with certainty, and 
(ii) in the case the input is not in L, no prover P' can convince V with probability more than 1/2. It 
is well-known that the class of languages having interactive proof systems, denoted by IP, is equal to 
PSPACE, shown by Shamir [^01 based on the work of Lund, Fortnow, Karloff, and Nisan and on 
the result of Papadimitriou ^3 (see also [HJ ) . 

Quantum interactive proof systems were introduced by Watrous j35j in terms of quantum circuits. 
He showed that every language in PSPACE has a quantum interactive protocol, with exponentially 
small one-sided error, in which the prover and the verifier exchange only three messages. A consecutive 
work of Kitaev and Watrous [23'| showed that any quantum interactive protocol, even with two-sided 
bounded error, can be parallelized to a three-message quantum protocol with exponentially small one- 
sided error. They also showed that the class of languages having quantum interactive proof systems 
is necessarily contained in deterministic exponential time (EXP). 

A multi-prover interactive proof system, introduced by Ben-Or, Goldwasser, Kilian, and Wigder- 
son 0, is an extension of a (single-prover) interactive proof system in which a verifier communicates 
with not only one but multiple provers, while provers cannot communicate with each other prover 
and cannot know messages exchanged between the verifier and other provers. A language L is said 
to have a multi-prover interactive proof system if, for some k denoting the number of provers, there 
exists a verifier V such that (i) in the case the input is in L, there exist provers Pi,. . . ,Pk that can 
convince V with certainty, and (ii) in the case the input is not in L, no set of provers . . . , can 
convince V with probability more than 1/2. Babai, Fortnow, and Lund 0, combining the result by 
Fortnow, Rompel, and Sipser showed that the class of languages having multi-prover interactive 
proof systems, denoted by MIP, is equal to NEXP. A sequence of papers by Cai, Condon, and Lip- 
ton ^3 , Feige , and Lapidot and Shamir [2S1 led to a result of Feige and Lovasz JH] that every 
language in NEXP has a two-prover interactive proof system with just one round (i.e. two messages) 
of communication (meaning that the verifier sends one question to each of the provers in parallel, then 
receives their responses), with exponentially small one-sided error. 

In this paper we first define quantum multi-prover interactive proof systems by naturally extending 
the quantum single-prover model. Perhaps the most important and interesting difference between 
quantum and classical multi-prover interactive proofs is that provers may share entanglement a priori . 
Particular cases are protocols with two provers initially sharing lots of EPR pairs. For the sake of 
generality, we may allow protocols with any number of provers and with any kind of prior entanglement, 
not limited to EPR-type ones. Although sharing classical randomness among provers does not change 
the power of classical multi-prover interactive proofs (unless zero-knowledge properties are taken into 
account ^), sharing prior entanglement does have a possibility both to strengthen and to weaken 
the power of quantum multi-prover interactive proofs. In fact, while sharing prior entanglement may 
increase the power of cheating provers as shown by Cleve 112 , it may be possible for a quantum verifier 
to turn the prior entanglement among provers to his advantage. 

The main result of this paper is to show the NEXP upper bound for quantum multi-prover interac- 
tive proof systems under the assumption that provers are allowed to share at most polynomially many 
prior-entangled qubits. That is, polynomially many prior-entangled qubits among provers cannot be 
advantageous to a quantum verifier. As a special case of this result, it is proved that, if provers do 
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not share any prior entanglement with each other, the class of languages having quantum multi-prover 
interactive proof systems is equal to NEXP. Another result related to these is that, in the case the 
prover does not have his private qubits, the class of languages having quantum single-prover interac- 
tive proof systems is also equal to NEXP. This special model of quantum single-prover interactive 
proofs can be regarded as a quantum counterpart of a probabilistic oracle machine |E1 ^1 H] in the 
sense that there is no private space for the prover during the protocol, and thus we call this model as 
a quantum oracle circuit. Our result shows that quantumization of probabilistic oracle machines does 
not change the power of the model. 

To prove the NEXP upper bound of quantum multi-prover interactive proof systems, a key idea is to 
bound the number of private qubits of provers without diminishing the computational power of them. 
Suppose that each prover has only polynomially many private qubits during the protocol. Then the 
total number of qubits of the quantum multi-prover interactive proof system is polynomially bounded, 
and we can show that it can be simulated classically in non-deterministic exponential time. Now the 
point is whether space-bounded quantum provers (i.e. provers can apply any unitary transformations 
on their spaces, but the number of qubits in their spaces is bounded polynomial with respect to the 
input length) are as powerful as space-unbounded quantum provers or not. Under the assumption 
that provers are allowed to share at most polynomially many prior-entangled qubits, we show that, 
even with only polynomially many private qubits, each prover can do everything that he could with 
as many qubits as he likes, in the sense that the verifier cannot distinguish the difference at all. For 
this, we also prove one fundamental property on quantum information theory using the entanglement 
measure introduced by Nielsen [27^. Apart from quantum interactive proof systems, this property 
itself is also of interest and worth while stating. 

The remainder of this paper is organized as follows. In Section |2l we briefly review basic notations 
and definitions in quantum computation and quantum information theory. In Section [H] we give a 
formal definition of quantum multi-prover interactive proof systems and quantum oracle circuits. In 
Section we show our main result of the NEXP upper bound of quantum multi-prover interactive 
proof systems. In Section El we focus on the prior unentangled cases and on quantum oracle circuits. 
Finally we conclude with Section El which summarizes our results and mentions a number of open 
problems related to our work. 

2 Quantum Fundamentals 

Here we briefly review basic notations and definitions in quantum computation and quantum infor- 
mation theory. Detailed descriptions are, for instance, in |2fll I28| [22|. 

A pure state is described by a unit vector in some Hilbert space. In particular, an n-dimensional 
pure state is a unit vector 1-0) in C". Let {|ei), . . . , |e„)} be an orthonormal basis for C". Then any 
pure state in C" can be described as Oii\ei) for some ai, . . . , a„. G C, Y17=i I'^iP = ^■ 

A mixed state is a classical probability distribution < pi < 1, "^^Pi = 1 over pure 

states \ipi). This can be interpreted as being in the pure state IV'i) with probability pi. A mixed state 
is often described in the form of a density matrix p = '^,iPi\tpi){tpi\- Any density matrix is positive 
semidefinite and has trace 1. 

If a unitary transformation U is applied to a state \^), the state becomes ?7|'i/')- In the form of 
density matrices, a state p changes to UpU^ after U is applied. 

One of the important operations to density matrices is the trace-out operation. Given a density 
matrix p over IC, the state after tracing out /C is a density matrix over H described by 

n 

^T^tcP = '^{I'H ® {ei\)p{In ® |ej)) 

i=l 

for any orthonormal basis {|ei), . . . , |e„)} of /C, where n is the dimension of /C and Ij^ is the identity 
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operator over TC. To perform this operation on some part of a quantum system gives a partial view of 
the quantum system with respect to the remaining part. 

One of the important concepts in quantum physics is a measurement. Any collection of linear 
operators {^i, . . . , Af^} satisfying ^l^i = ^ defines a measurement. If a system is in a pure state 
\ip), such a measurement results in i with probability and the state becomes II- 

If a system is in a mixed state with a density matrix p, the result i is observed with probability 
tT{AipAl), and the state after the measurement is with a density matrix AipAl/ti{AipAl). A special 
class of measurements are projection or von Neumann measurements in which {Ai,...,Ak} is a 
collection of orthonormal projections. In this scheme, an observable is a decomposition of TC into 
orthogonal subspaces Tii, . . . , TLk, that is, Ti. = TCi © • • • © Tik- It is important to note that two mixed 
states having the identical density matrix cannot be distinguished at all by any measurement. 

For any linear operator A over 7i, the /2-norm of A is defined by 

11^1^^)11 
Pll = sup " ' 

|V>eW\{0} 



3 Definitions 

3.1 Polynomial-Time Uniformly Generated Families of Quantum Circuits 

Similar to the model of quantum single-prover interactive proof systems discussed in |35| I23j , we define 
quantum multi-prover interactive proof systems in terms of quantum circuits. Before proceeding to the 
definition of quantum multi-prover interactive proof systems, we review the concept of polynomial-time 
uniformly generated families of quantum circuits. 

A family {Qx} of quantum circuits is polynomial-time uniformly generated if there exists a deter- 
ministic procedure that, on every input x, outputs a description of Qx and runs in time polynomial in 
n = \x\. For simplicity, we assume all input strings are over the alphabet S = {0, 1}. It is assumed that 
the circuits in such a family are composed of gates in some reasonable, universal, finite set of quantum 
gates such as the Shor basis jnHIHl: Hadamard gates, ^/d^ gates, and Toffoli gates. Furthermore, it is 
assumed that the number of gates in any circuit is not more than the length of the description of that 
circuit. Therefore Qx must have size polynomial in n. For convenience, we may identify a circuit Qx 
with the unitary operator it induces. 

It should be mentioned that to permit non-unitary quantum circuits, in particular, to permit 
measurements at any timing during the computation does not change the computational power of the 
model in view of time complexity. See for a detailed description of the equivalence of the unitary 
and non-unitary quantum circuit models. 



3.2 Quantum Multi-Prover Interactive Proof Systems 

Here we give a formal definition of quantum multi-prover interactive proof systems which is a natural 
extension of quantum single-prover ones defined by Watrous jHS]- In fact, the model of quantum single- 
prover interactive proof systems discussed in [A^ \2'A\ is a special case of our quantum multi-prover 
model with the restriction of the number of provers to one. 

Let k be the number of provers. For every input x E S* of length n = \x\, the entire system of 
quantum /c-prover interactive proof system consists of q{n) = q\){n) + Yli=i(.lMi{i^) + QVtif^)) qubits, 
where qv{n) is the number of qubits that are private to a verifier V, each q-p^in) is the number of 
qubits that are private to a prover Pi, and each qMii'^') is the number of message qubits used for 
communication between V and Pj. Note that no communication is allowed between different provers 
Pi and Pj. It is assumed that gv and each qj^^^ are polynomially bounded functions. Moreover, 
without loss of generality, we may assume that qMi = • • • = qMk — 1M and q-p^ = ■ ■ ■ = q-p^ = q-p. 
Accordingly, the entire system consists of q{n) = qv{n) + k{qM{n) + q-pi^)) qubits. 



4 



private qubits - 

of prover 1 : 

message qubits — 

with prover 1 — 



private qubits 
of verifier 



message qubits — 

with prover 2 : 

private qubits I 

of prover 2 — 




— output qubit 
/ 



Figure 1: Quantum circuit for a three-message quantum two-prover interactive proof system 



Given polynomially bounded functions ni,q\;,qM- '^'^ an m-message {q\;, qM)-f^stricted 

quantum verifier V for a quantum fc-prover interactive proof system is a polynomial-time computable 
mapping of the form V : 'S* ^ T,*, where S = {0, 1} is the alphabet set. For every input x G S* of 
length n, V uses at most qv{n) qubits for his private space and at most qM-ip) qubits for communication 
with each prover. The string is interpreted as a [m(n)/2 -|- Ij -tuple {V{x)i^ . . . ,V{x)\^(^n)/2+i\)i 
with each V{x)j a description of a polynomial-time uniformly generated quantum circuit acting on 
qv{n) + kqMip) qubits. One of the private qubits of the verifier is designated as the output qubit. 

Given polynomially bounded functions m, q_M '■ N and a function q-p : Z"^ N, an m-message 

{QM: qv)-''^Gstricted quantum prover Pi for each i = 1, . . . ,k is a mapping of the form Pj : S* S*. 
For every input x G T,* of length n, each Pi uses at most q-p^n) qubits for his private space and at most 
Qm{''T') qubits for communication with the verifier. The string Pi{x) is interpreted as a [m(n)/2 + l/2j- 
tuple {Pi{x)i, . . . , Pi{x)^m{n)/2+i/2\)j with each Pi{x)j a description of a quantum circuit acting on 
Qm{''T') + Qvin) qubits. No restrictions are placed on the complexity of the mapping Pi (i.e., each 
Pi{x)j can be an arbitrary unitary transformation). Furthermore, for some function ^ent : N 
satisfying gent < Qv , each Pi may have at most gent (n) qubits among his private qubits that are prior- 
entangled with some private qubits of other provers. Such a prover Pi is said q(,^t-pi"ior- entangled. For 
the sake of generality, we allow any kind of prior entanglement, not limited to EPR-type ones. 

An m-message (qy, qj\^, q-p) -restricted quantum k-prover interactive proof system consists of an m- 
message (gv, Q'A^)-restricted quantum verifier V and m-message (g^n, gp)-restricted quantum provers 
Pi, . . . , Pk- If Pi, . . . , i-fc are gent-prior-entangled, such a quantum /c-prover interactive proof system 
is said qcnt-prior- entangled. Let V = l2{^'^^), each Aii = l2iT,'^^), and each Vi = Z2(S'^''') denote the 
Hilbert spaces corresponding to the private qubits of the verifier, the message qubits between the veri- 
fier and the ith prover, and the private qubits of the rth prover, respectively. Given a verifier V , provers 
Pi, ... , Pfc, and an input x of length n, we define a circuit (Pi(x), . . . , Pk{x), V{x)) acting on g(n) qubits 

as follows. If m(n) is odd, circuits Pi(j;)i,. . . ,Pfc(x)i, F(x)i, . . ., Pl{x)i^rn{n)+l)/2, ■ ■ ■ , Pk{x)(^rn{n)+l)/2, 

^(^)(m(n)+i)/2 are applied in sequence, each Pi{x)j to M.i®Vi, and each V{x)j to V^A^i ® ■ ■ ■ ® M.k- 
If m{n) is even, circuits V{x)i, Pi(x)i, . . . , Pfc(x)i, . . ., V{x)^(^n)/2, Pi{x)m{n)/2, ■ ■ ■ ,Pk{x)m{n)/2, 
^(^)m(n)/2+i are applied in sequence. Figure ^ illustrates the situation for the case k = 2 and 
m(n) = 3. Note that the order of applications of the circuits of the provers at each round has actually 
no sense since the space Mi®Vi on which the circuits of the iih. prover act is separated from each 
other prover. 

At any given instant, the state of the entire system is a unit vector in the space V 03 A^i • • • 
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M.k ^Vi® ■ ■ ■ ^Vk- For instance, in the case m(n) = 3, given an input x of length n, the state of the 
system after all of the circuits of the provers and the verifier have been applied is 

V2Pk,2---Pl,2VlPk,l---Pl,l\i^irai), 

where each Vj and Pjj denotes the extension of V{x)j and Pi{x)j, respectively, to the space V (8) 
Ml (g) • • • (8) Mk ®V\® ■■■®Vk by tensoring with the identity, and |'i/'init) G V (g) Mi Mk ® 

Vi ® ■ ■ ■ ®Vk denotes the initial state. In the initial state I'f/'init) for gcnt-prior-entangled proof systems, 
only the first Qentin) qubits in each Vi may be entangled with other qubits in Pi • • • (g) P^. All the 
qubits other than these prior-entangled ones are initially in the |0)-state. 

For every input x, the probability that the [k + l)-tuple (Pi, . . . , Pfe, V) accepts x is defined to be 
the probability that an observation of the output qubit in the basis of {|0), |1)} yields after the 
circuit (Pi(x), . . . , Pk{x), V{x)) is applied to the initial state iV'init)- 

Although k, the number of provers, has been treated to be constant so far, the above definition 
can be naturally extended to the case that A; : Z+ — N is a function of the input length n. In what 
follows, we treat A; as a function. Note that the number of provers possible to communicate with the 
verifier must be bounded polynomial in n. 

Definition 1 Given polynomially bounded functions A;, m : Z+ — N, a function Qent : Z"*" — > N, and 
functions a, b: Z+ [0, 1], a language L is in QMIP(A;, m, Qcnt, a, b) iff there exist polynomially bounded 
functions qv,QM- ~^ N and an m-message {qy^qM) -restricted quantum verifier V for a quantum 
k-prover interactive proof system such that, for every input x of length n, 

(i) if X G L, there exist a function q-p : Z"*" N satisfying q-p > gent o,nd a set of k quantum provers 
Pi,...,Pfc of m-message {qM^ qp)-i"sstricted qent-P'rior-entangled such that (Pi, . . . , P^, F) ac- 
cepts X with probability at least a{n), 

(ii) if X ^ L, for all functions q'-pi — > N satisfying q'j, > gent o-nd all sets of k quantum provers 
Pi, . . . jPj, of m-message {qM^f^-p) -"restricted q^nt -prior- entangled, {Pi, . . . , P^, V) accepts x with 
probability at most b{n). 

Let QMIP (poly, poly, qcnt, a, b) denote the union of the classes QMIP(A;, m, gent, ^) over all poly- 
nomially bounded functions k and m. The class QMIP of languages having quantum multi-prover 
interactive proof systems is defined as follows. 

Definition 2 A language L is in QMIP iff there exists a function gent '■ Z"*" N such that, for any 
function q'^^^: Z+ ^ N satisfying q'^^^ > gent, L is in QiMIP {poly, poly ,q'^^^, 1, 1/2). 

Next we define the class QMIP^i-'^ ) of Ian guages having quantum multi-prover interactive proof 
systems with at most polynomially many prior-entangled qubits. 

Definition 3 A language L is in QMIP'^'''^'-' iff there exists a polynomially bounded function 
gent : Z+ N such that, for any polynomially bounded function q'^^<^ : Z+ — >■ N satisfying q'^^<^ > gent , L 
is in q^AlV {poly, poly, q'^^<^, 1, 1/2). 

Finally we define the class QMIP*^'^^ '^') of languages having quantum multi-prover interactive proof 
systems without any prior entanglement. 

Definition 4 A language L is in QMIP^"'^) iff L is in QMIP {poly, poly, 0, 1, 1/2). 
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Figure 2: Quantum circuit for a two-oracle-call quantum oracle circuit 



3.3 Quantum Oracle Circuits 

Consider a situation in which a verifier can communicate with only one prover, but the prover does 
not have his private qubits. We call this model a quantum oracle circuit, since it can be regarded as a 
quantum counterpart of a probabilistic oracle machine jl7[ 1151 [H] in the sense that there is no private 
space for the prover during the protocol. 

For the definition of quantum oracle circuits, we use slightly different terminologies from those in 
the previous subsection so that they are fitted to the term 'oracle' rather than 'prover'. 

Given polynomially bounded functions m,q\;,qo- N, an m-oracle-call {qy,qo) -restricted 

quantum verifier V for a quantum oracle circuit is a 2m-message (gv; 9o)-restricted quantum verifier 
for a quantum single-prover interactive proof system. A qo -restricted quantum oracle O for an m- 
oracle-call (gvi '?C')-restricted quantum verifier is a 2m-message ((70, 0)-restricted quantum prover. 
Figure IS illustrates the situation of a two-oracle-call quantum oracle circuit. Note that our definition 
of a quantum oracle completely differs from the one by Bennett, Bernstein, Brassard, and Vazirani [S] 
in which a quantum oracle is restricted to a unitary transformation that maps \y,z) to \y,z © /(y)) 
in one step for an arbitrary function /: {0, 1}* {0, 1}. 

Definition 5 Given a polynomially bounded function m: Z"*" N and functions a,b: Z+ — > [0,1], a 
language L is in QOC(m, a, b) iff there exist polynomially bounded functions qy, qo '■ '^'^ — > N and an 
m-oracle-call {qy , qo) -restricted quantum verifier V for a quantum oracle circuit such that, for every 
input X of length n, 

(i) if X £ L, there exists a qo-restricted quantum oracle O for V such that V with access to O 
accepts X with probability at least a{n), 

(a) if X ^ L, for all qo-restricted quantum oracles O' for V, V with access to O' accepts x with 
probability at most h{n). 

Let QOC{poly, a, b) denote the union of the classes QOC(m, a, b) over all polynomially bounded func- 
tions m. The class QOC of languages accepted by quantum oracle circuits is defined as follows. 

Definition 6 A language L is in QOC iff L is in QOC^poly, 1, 1/2). 

4 QMIP(^-^ ) C NEXP 

Now we show that every language having a quantum multi-prover interactive proof system is necessarily 
in NEXP under the assumption that provers are allowed to share at most polynomially many prior- 
entangled qubits. 

A key idea of our proof is to bound the number of private qubits of provers without diminishing the 
computational power of them. First, in Subsection 14.11 we explain our bounding technique with the 
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single-prover case, which is much easier to understand. Although our result for the single-prover case 
only gives the NEXP upper bound for the class QIP of quantum single-prover interactive proofs, it will 
be much of help to understand our key idea of the proof for the multi-prover case in Subsection 14.21 
For simplicity, in this section and after, we often drop the argument x and n in the various functions 
defined in the previous section. We also assume that operators acting on subsystems of a given system 
are extended to the entire system by tensoring with the identity, when it is clear from context upon 
what part of a system a given operator acts. 

4.1 Single-Prover Case 

First we show that, for any protocol of quantum single-prover interactive proof systems, there exists 
a quantum single-prover interactive protocol exchanging the same number of messages, in which the 
prover uses only polynomially many qubits for his private space with respect to input length, and the 
probability of acceptance is exactly equal to that of the original one. To show this, the following two 
theorems play very important roles. A point of our proof is how to combine and apply these two to 
the theory of quantum interactive proof systems. 

Theorem 7 ((MI[21]) Let G 7^2 satisfy tr^a 10) (0] = trn^li^) 0^1 ■ Then there is a 

unitary transformation U over TC2 such that {I-Hx = where I-j-i^ is the identity operator 

over Til. 

Theorem 8 r|28|. page 110) Let p he a density matrix overTCi. Then there exist a Hilbert space 
TI2 of dim{Ti.2) = dim('Hi) and a pure state \^) G "Hi "^2 such that tr-?^2|^)(^| = p. 

Now we give a proof of our claim. 

Lemma 9 Let m,q\;,qM- '^'^ — > N 5e polynomially bounded functions and V be an m-message 
{q\;,qM) -restricted quantum verifier for a quantum single-prover interactive proof system. Then, for 
any function q-p: Z"*" N and any m-message {qMjQv) -restricted quantum prover P, there exists an 
m-message (qM^QV + qM) -restricted quantum prover P' such that, for every input x, the probability 
of accepting x by (P' , V) is exactly equal to the one by (P, V). 

Proof. It is assumed that > + QM^ since there is nothing to show in the case (?-p < Q'v + QM- It 
is also assumed that the values of m are even (odd cases can be dealt with a similar argument). 

Given a protocol (P, V) of an m-message {q\;, g^v), g-p)-restricted quantum single-prover interactive 
proof system, we construct an m-message {qMiOV + )-restricted quantum prover P' such that the 
probability of acceptance by (P', V) is exactly equal to the one by (P, V) on every input. We construct 
P' by showing, for every input x, how to construct each Pj{x) based on the original Pj{x). In the 
following proof, each Pj{x) and Pj(x) will be abbreviated as Pj and Pj, respectively. 

Let V = 12{T,'^^^'^^) be the Hilbert space corresponding to the private qubits of P'. Let each 
\tpj), \(pj) G V 7W P, for 1 < j < m/2, denote a state of the original m-message {qviQMilv)- 
restricted quantum interactive proof system defined in a recursive manner by 



Here iV'init) G V ® M ®V is the initial state in which all the qubits are the |0)-states. Notice that 
tr_A4(g)'p|'0j)(V'il = tr^0p|(/)j)(i5!)j| for each 1 < j < m/2, since each Pj acts only on the qubits in M.®V. 



I'/'i) 



VllV'imt), 

VjPj-i\(t)j^i), 2<i<m/2, 
Pil^i), l<i<m/2. 
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for each 1 < j < m/2. Thus we have 

trA1®P'|V'j-)(V'j-| = trx®7'l'0i)(^il = ^'^M<»v\4'j){4>j\ = i'CM^V'\<P'j){'P'j\, 
for each 1 < j < m/2. 

Therefore, by Theorem there exists a unitary transformation Pj acting on 7W "P' such that 
P^\(j)'.) = \ip'.) for each l<j< m/2. 

Having defined Pj, |(/)^), and for each 1 < j < m/2, compare the state just before the final 
measurement is performed in the original protocol and that in the constructed protocol. Let \(prn/2+i) = 
Vm/2+i\i^m/2) and |0'„/2+i) = ^m/2+ilV'm/2)- ^hcsc \4>m/2+i) and |(/>^/2+i) are exactly the states we 
want to compare. Noticing that tTp\ipm/2){^m/2\ = tr-p'|^^/2)(V'm/2l' ^^'^^ i'^v\4'm/2+i){4'm/2+i\ = 
/2+il' since 14i/2+i acts only on \> ® M. This imphes that the verifier V cannot 
distinguish |</'^/2+i) fro™ \4>m.j2+\) at all. Hence, for every input x, the probability of accepting x 
in the protocol (P', V) is exactly equal to the one in the original protocol (P, V). Thus we have the 
assertion. □ 



4.2 QMIP(' ) C NEXP 

In the proof of Lemma we decomposed the Hilbert space of the proof system into V ® M and V and 
used TheoremlSlby taking as a Hilbert space Hx of Theorem|HJ For /c-prover cases, however, if 

we focus on one fixed prover Pj and decompose the Hilbert space of the proof system into the private 
space of Pj and the rest. Theorem IS] is of no help, because the number of qubits of the proof system 
out of Vi may be no longer bounded polynomial in input length. Instead of Theorem |S1 we show the 
following theorem, which is useful even for /c-prover cases. 

Theorem 10 Fix a state {(p) in7ii®7i2®'H^ and a unitary transformation U over7i2®'H^ arbitrarily, 
and let denote {lui ®U)\(I)). Then, for any Hilbert space TL'^ o/dim(7^3) < dim('H3) such that there 
is a state |(/)') in TCi (X" "^2 "X satisfying tici^'J(j)'){(j)'\ = trj^^lcj)) , there exist a Hilbert space TL'l of 
diTii{n'l) = (dim(?t:2))^-dim(?t:^) and a state \^') inni®n2®'H'l such t/iaUr^//|^/;')(V''| = iTH3\'>P){M- 

For the proof of Theorem IIUI we use the entanglement measure introduced by Nielsen [27j. Let us 
decompose a vector \S) G "Hi "^2 into 

\i) = Y.a,M)®\^])^ (1) 

where {|ej)} and {|e?)} are orthonormal bases of Tii and 7^2) respectively. Then the entanglement 
measure ent2(|0)^i)^2) is defined by the minimum number of non-zero terms in the right hand side 
of where the minimum is taken over all the possible choices of the bases {|e]^)} and {|e^)}. The de- 
composition with the minimum number of non-zero terms is given by the Schmidt decomposition l34j . 

i 

where each \e\) and |ef) is a normalized eigenvector of tr7.^J^)(,^| and tr7^2lO('^l' respectively. There- 
fore, the entanglement measure ent2(|C)j "^2) is nothing but the minimum dimension of the Hilbert 
space 'H'2 such that there is a vector |^') G Hi (g) 'H'2 that satisfies tr>^2lO('?l = tr.^/^|^')(^'|. 

We extend the definition of ent2(-, •, •) to a three-party case. For a vector \C,) £ Tii 7i2 TC^, 
define the three-party entanglement measure ent3(|C), T^i, 7^2) ^3) as the minimum number of non-zero 
terms in the decomposition 

\0 = ^l^Jk\el)'^\e])(g)\el), 
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where {|e])} denotes an orthonormal basis of the space TCj for each j = 1,2,3. 

Proof of Theorem MCA Since ent2{\il^),'Hi ^2,^3) gives the minimum dimension of 7i'^ such that 
there is a state \tp') £ TLi (gi 7^2 ® satisfying tr^//|-i/'')('0'| = tr7^3lV')(V'|i it is sufficient to show that 
e-at2{\ilj) ^TLi C^'H2,'Hs) < dim('H3) • (dim('H2))^- This can be proved as follows: 

ent2(|^),7^l 0^2,^3) < ent3(|V'),Wi, 7^2,^3) 

< ent3(|0),Hi,W2,W3) •dim(W2) 

< ent2(|</>),Wi 0^2,^3) • (dim(W2))^ 

< dim(?t:;5) • (dim(?t:2))^. 

The first inequality directly comes from the definition of the entanglement measure. To prove the 
second and third inequalities, let = "^Zi j k^ijkl^l) ® l^j) ® l^t) the decomposition of {(p) with 
respect to the orthonormal bases {|ej)}, {|e?)}, and {|e?)} of Tii, Ti.2, and TC^, respectively, and let 
= J2iPi\fi ' ) ® \ fi) ^6 that of \4>) with respect to the orthonormal bases ' )} and {\f[)} of 
Ti-i (8> H2 and H3, respectively. The second and third inequalities are the consequences of the equality 

(dim{W2) 
1=1 

and the equality 



/dim(W2) \ 
i i \ j=l J 

respectively, where Ya^:^^'^^^ f^jkil'^'jki) ® ^""^ Ylf=i''^^^ ® (•^j^) ^"^^ Schmidt decompo- 

sitions of U{\e'j) (g) |e^)) and |//'^), respectively. The fourth inequality is from the definition of the 
entanglement measure, which ensures that ent2{\(j)),Ti.i (8) 'H2,'H3) < dim('H3) holds. □ 

Now we are ready to show the following lemma. 

Lemma 11 Let k, m, gy, QM^Qent '■ N be polynomially bounded functions and V be an m-message 

{q^ , qjii) -restricted quantum verifier for a quantum k-prover interactive proof system. Then, for any 
function q-p: TL^ — > N satisfying q-p > gent o,nd any set of m-message {qj^, Qv) -restricted qent-pi"ior- 
entangled quantum provers Pi, ... , P^, there exists a set of m-message {qjvi^ lent + 2[m/2 + l/2\q_M)- 
restricted q^^t-prior- entangled quantum provers P[, . . . ,P'j^ such that, for every input x, the probability 
of accepting x by {P[, . . . ,Pl^,V) is exactly equal to the one by (Pi, . . . , Pk,V). 

Proof. It is assumed that q-p > gent + 2[m/2 + l/2\q_M, since there is nothing to show in the 
case qp < gent + 2[m/2 + l/2\q_M- It is also assumed that the values of m are even, and thus 
2[m/2 + l/2jg^ = mqj^ (odd cases can be dealt with a similar argument). 

Given a protocol (Pi, . . . , P^, V) of an m-message {qy, g_A/(, gp)-restricted gent-prior-entangled quan- 
tum fc-prover interactive proof system, we first show that Pi can be replaced by an m-message 
(gx,gent + mg^)-restricted gent-prior-entangled quantum prover P{ such that the probability of ac- 
ceptance by (P{, P2, . . . , Pfc, V) is exactly equal to the one by (Pi, . . . , P^, V) on every input. Having 
shown this, we repeat the same process for each of provers to construct a protocol (P{, P2, P3, . . . ,Pk,V) 
from (P{, P2, P3, . . . , Pfc, V) and so on, and finally we obtain a protocol (P{, . . . , P^, V) in which all 
of P(,...,P^ are m-message (gA^,gent + mg;\4)-restricted gent-prior-entangled quantum provers. We 
construct P{ by showing, for every input x, how to construct each P[ j(x) based on the original Pij(x). 
In the following proof, each Pij{x) and Pij{x) will be abbreviated as Pjj and P/j, respectively. 
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Let each j-i/'j), \(t)j) G V Mi • • • Mk ^ Vi ^ ■ ■ ■ ^ Vk, iov 1 < j < m/2, denote a state of 
the original m- message {qv, g^, g-p)-restricted gent-prior-entangled quantum A;-prover interactive proof 
system defined in a recursive manner by 

= l^llV'init), 

= yjPKj-i---Pi,3-Mj-i), 2<j<m/2, 
IV-i) = l<j<m/2. 

Here iV'init) £ V^A^i®- • ■(^Aik®'Pi®- ■ -^Vk is the initial state in which the first (?ent("-) qubits in each 
Vj may be entangled with private qubits of other provers than Pj. All the qubits other than these prior- 
entangled qubits are the |0)-states in the state iV'imt)- Note that tr^^,g-pj'i/'j)('0il = ^'^Mi(&'Pi\4>j){4'j\i 
for each 1 < j < m/2. 

We define each P[ ■ recursively. To define P[ consider the states |(/>i) and \4>i)- Let = 
Since all of the last (g-p — gent) qubits in Vi in the state \(t)i) are the |0)-states and I^/ji) = Pi^ij^i), by 
Theorem Uni there exists a state |V''i) vciV ® Mi® ■ ■ ■ ® Mk®Vi® ■ ■ ■ ®Vk such that 

iTvM){^l^'i\=trvMi){^i\ 
and all but the first gent + '^Qm qubits in Vi are the |0)-states in the state Furthermore we have 

ti'A4i®PilV'i)(V''il = trA4i^pjVi)(V'i| = trA^i^pJc/)! )((/>! I = trA4l®Pll0^)(0il• 
Therefore, by Theorem there exists a unitary transformation Qi^i acting on Mi ®Vi such that 
Qi,iWi) = Wi) and Qi^i is of the form P[ ^ (g) Iq-p-q^^t-rnqM^ where P[ is a unitary transformation 
acting on qubits in A^i and the first qcnt+TrnQM qubits of Pi, and Iq-p-q^nt-mqM {qv — Qent—'mQM)- 

dimensional identity matrix. 

Assume that Qij, I'P'j)} and iV'j) have been defined for each j, 1 < j < < m/2 — 1, to satisfy 

. = Vi\4^init), 

|(/.;) = VjPk,j-i ■ ■ ■ P2,i-iQi,i-ii0;_i>, 2 < j < e, 
. tTv,\i^j){i^j\ = trpjv;-)(^;-i, 1 < i < 

• All but the first gent + 2(j — l)qM qubits in Vi are the |0)-states in the state {(f'j)- 

• All but the first gent + '^Jqm qubits in Vi are the |0)-states in the state \ipj)- 

Notice that Qi,i, \(pi), and {ip'^) defined above satisfy such conditions. Define and 
in the following way to satisfy the above four conditions for j = ^ + 1. 
Let = V^+iPfc^g • • • -P2,g and define = U^ltp'^)- Then all but the first gent + "^(.Qm qubits 

in Vi are the |0)-states in the state \(j)'^_^_l), since none of ^2,5, • • • > Pk,£,, V^+i acts on the space Vi and 
\ip'^) satisfies the fourth condition. Since tr-p-^lip^) {tp^\ = tl^:■p-^\^p'^){^p'^\, by Theorem[71 there exists a 
unitary transformation acting on Vi such that A^\ip'^) = Thus we have 

iV'g+i) = Pi,^+iU^\iJ^) = Pi^^+iU^A^lij'i:) = Pi,^+iA^U^\ij'^) = Pi,5+iA5l4+i). (2) 
Hence, by Theorem there exists a state iV'^+i) such that 

trvi\i^'^+i){i''^+i\ = tr^JV€+i)(V'5+il (3) 

and all but the first gent + 2(^ + l)qM qubits in Pi are the |0)-states in the state \tp'^_^_i). From Q and 
we have 

trA^i®PilV'^+i>(V'^+il = trA^i®PilV'€+i>(V'5+i| = trA^i®Pil4+i)^4+il' 
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since -Pi,^+i and ^4^ act only on Mi ^ Vi- Therefore, by Theorem [7| there exists a unitary transfor- 
mation Qi^g+i acting on Aii ®Vi such that Qi^£^+i\4>'^j^i) = iV'^+i)- It follows that Qi^g+i is of the 
form Iq^-q^^^-rnqM i whcrc P[ IS & Unitary transformation acting on qubits in Aii and the 

first gent + mqM qubits of Vi, because all of the last q-p — gent — rnqj^ qubits in Vi are the |0)-states 
in both of the states I'/'^+i) and iV'^+i)- One can see that Qi^^+i, and \tp'^^i) satisfy the four 

conditions above by their construction. 

Having defined Qij,\(j)'j),\'ipj) for each 1 < j < m/2, compare the state just before the final 
measurement is performed in the original protocol and that in the modified protocol applying Qij's 
instead of Pi/s. For U,^/2 = Ki/2+i^fc,m/2 ' ' ' ^2,m/2> let \4>m/2+i) = f^m/2lV'm/2> and I'/'^/a+i) = 
Um/2\^'m/2) ■ Thesc \(pm/2+i) and \4''m/2+i) exactly the states we want to compare. Noticing that 

trPi|V'm/2)(V'm/2l = t'^T'i I V'm/2) (^^^72 1 ' ^^^Ve trpj 0^/2+1 ) (</)m/2+l | = ^^Vi\4>'m/2+l) (^'m/2+l\^ ^^"^^^ 

none of P2,m/2, • • • , Pk,m/2, Ki/2+1 acts on Vi. Thus we have 

tl'Pi(g)...®T'fc|</'m/2+l)('^m/2+ll = ^'^Vi<»-<S$rk\Kri/2+l) iKn/2+l\^ 

which implies that the verifier V cannot distinguish |0^/2+i) l0m/2+i) at all. Hence, for every 

input X, the probability of accepting x in the protocol (Qi, P2, ■ ■ ■ , Pk,V) is exactly equal to the one in 
the original protocol (Pi, . . . , Pk,V), and Qi uses only gent + mq_\4 = gent + 2 • (m/2) • qj\^ qubits in his 
private space. In the protocol (Qi, P2, ■ ■ ■ , Pk-, each Qij is described as Qij = P[ ^(^Iq^-q^^^^-mqj^ , 
where P[^j^i is a unitary transformation acting on qubits in M.i and the first gent + mnqM qubits of 
Vi. Consequently, by constructing an m-message (g^v), gent + 'TT'9A^)-i'estricted quantum prover P[ from 
each for every input x^ the probability of accepting x in the protocol (P{, P2) • • • , -Pfc, ^) is exactly 
equal to the one in the original protocol (Pi , . . . , P^ , F) . 

Now we repeat the above process for each of provers, and finally we obtain a protocol (P(, . . . , Pj^, y) 
in which all k provers are m-message (gx, gent + mgx)-restricted quantum provers. It is obvious that, 
for every input x^ the probability of accepting x in the protocol (P{, . . . , P^, F) is exactly equal to the 
one in the original protocol (Pi, ... , Pfc, F), and we have the assertion. □ 

From Lemma im it is straightforward to show the following lemma. 

Lemma 12 For any polynomially bounded functions /c,m, gent: Z"*" — > N, QMIP(/c, m, gent, 1, 1/2) C 
NEXP. 

Proof. For convenience, we assume that the values of m are even (odd cases can be dealt with a 
similar argument). 

Let L be a language in QMIP(fc, m, gent, 1, 1/2). Then, from Definition ^ together with Lemma ITTl 
there exist polynomially bounded functions qv,QM- ~^ N and an m-message (gv, gA/()-restricted 
quantum verifier V for a quantum fc-prover interactive proof system such that, for every input x, (i) if 
X is in L, there exists a set of k quantum provers Pi, . . . , P^ of m-message (gA^i, gent + mg^vi )-restricted 
gent-prior-entangled such that (Pi, . . . ,Pk,V) accepts x with certainty, and (ii) if x is not in L, for all 
sets of k quantum provers P{, . . . , P^^ of m-message (g^^, gent + mg;v()-restricted gent-prior-entangled, 
(P{, . . . , Pj^, y) accepts X with probability at most 1/2. 

For an input x of length n, consider a classical simulation of this quantum fc-prover interactive 
proof system by a non-deterministic Turing machine. Let pi be arbitrary fixed polynomial. First, for 
the initial state iV'init), an approximation IV'init) of IV'init) can be guessed in time non-deterministic 
exponential in n with accuracy of HlV'init) — iV'init)!! < 2~P^^"'\ Next, since each Vj applied in the 
original proof system is polynomial-time uniformly generated and gv and qj^ are polynomially bounded 
functions, it is routine to show that an approximation Vj of a matrix description of Vj can be computed 
in time exponential in n with accuracy of || Vj- — < 2~p^^^\ Finally, since qj\4 and q-p = gent + ^qM 
are polynomially bounded functions, for each operation Pjj of the ith prover applied in the original 
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proof system, an approximation Pjj- of a matrix description of Pij can be guessed in time non- 
deterministic exponential in n with accuracy of \\Pij — Pi,j\\ < 2~P''-^^\ Thus, for the quantum state 

IV'final) = ym/2+lPk,m/2 ' ' ' -Pl,m/2Kn/2 " " " Pk,l ' ' ' -Pl,l Vl | V'init) , 

which is the state just before the final measurement in the proof system, the approximation 
iV'finai) of iV'finai) Can be Computed in time non-deterministic exponential in n with accuracy of 
>-|V'final)|| <2-P2W for any fixed polynomial p2 by appropriately choosing pi. 
Now, after having computed IV'finai); a measurement of the output qubit is simulated by summing 
up squares of the computed amplitudes in the accepting states. The input x is accepted if and only 
if this sum, the computed probability that the measurement results in is more than 1 — e. From 
the property of the original proof system, this computed probability is more than 1 - 2-2P2(n) if 

X IS 

in L, while it is less than 1/2 + 2~^^2(") [f ^ is not in L. Thus, taking p2 = n and e = 2~^", the input 
X is accepted if and only if x is in L and the whole computation is done in time non-deterministic 
exponential in n. □ 

Hence we have the following theorem. 

Theorem 13 QMIP^^ '^ ) C NEXP. 

Note that our upper bound of NEXP holds even if we allow protocols with two-sided bounded 
error, since the proof of Lemma ITT] does not depend on the accepting probabilities a, b, and the proof 
of Lemma IT^ can be easily modified to two-sided bounded error cases. 

5 QMIP("^ ) = QOC = NEXP 

In the previous section, we proved that the class of languages having quantum multi-prover interactive 
proof systems is necessarily contained in NEXP under the assumption that provers are allowed to share 
at most polynomially many prior-entangled qubits. As a special case of this, it is proved in this section 
that, if provers do not share any prior entanglement with each other, the class of languages having 
quantum multi-prover interactive proof systems is equal to NEXP. Another result related to this is 
that QOC is also equal to NEXP, or in other words, the class of languages having quantum single- 
prover interactive proof systems is also equal to NEXP if a prover does not have his private qubits. 

The inclusions QMIP^'"-^ ) C NEXP and QOC C NEXP directly come from Lemma [El Thus it is 
sufficient for our claim to show NEXP C QMIP("-^ ) C QOC. Fortunately, in the cases without prior 
entanglement, it is easy to show that a quantum verifier can successfully simulate any classical multi- 
prover protocol, in particular, a one-round two-prover classical interactive protocol that can verify a 
language in NEXP with exponentially small one-sided error ^^I- Thus, we have the following theorem 
and corollary. The proof of Theorem 1141 is straightforward, and thus omitted here (see Appendix E)) . 

Theorem 14 NEXP C QMIP^'^ '^ ). 

Corollary 15 For prior unentangled cases, if a language L has a quantum multi-prover interactive 
proof system with two-sided bounded error, then L has a two-message quantum two-prover interactive 
proof system with exponentially small one-sided error. 

The remainder of this section is devoted to the proof of QMIP'-'^ '''-' C QOC. 

Lemma 16 Let k,m: ^ N be polynomially bounded functions, and a,b: Z+ — > [0,1] be functions 
satisfying a>b. Then QMIP(A;, m, 0, a, b) C QOC(A; [(m + 1) /2j ,a,b). 
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Proof. For simplicity, we assume that the values of m are even, and thus A;[(m + l)/2j = km/2 (odd 
cases can be proved with a similar argument). 

Let L be a language in QMIP(A;, m, 0, a, b). Then, from Definition ^together with Lemma lTTl there 
exist polynomially bounded functions qy, qm : Z"*" — > N and an m- message (gv; (?Al)-restricted quantum 
verifier V for a quantum /c-prover interactive proof system such that, for every input x of length n, (i) 
if X is in L, there exists a set of m- message (gx, mg;vi)-restricted quantum provers Pi, . . . ,Pk without 
prior entanglement such that (Pi, . . . , Pk,V) accepts x with probability at least a(n), and (ii) if x is 
not in L, for all sets of m- message (g;\4, mq_A/()-restricted quantum provers P/, . . . without prior 
entanglement, (P^, . . . ,P^, V) accepts x with probability at most b{n). 

We construct a /i:m/2-oracle-call verifier yQ^^ of a quantum oracle circuit as follows. Let us con- 
sider that quantum registers (collections of qubits upon which various transformations are performed) 
W, Mj, and Pj, for 1 < i < k, are prepared among the private qubits of the verifier yQ^^^ ^^^^ 
quantum registers M and P are prepared among the qubits for oracle calls. W consists of gy qubits, 
each Mj and M consist of qubits, and each Pj and P consist of q-p = mqj^ qubits. Let W^*-"-^, 
each Al[°^^^, and each 'p^'-"^ denote the Hilbert spaces corresponding to the registers W, Mj, and Pj, 
respectively. Take the Hilbert space corresponding to the qubits private to the verifier yQ^^: 

as VQ°^ = M^'^'^ (g) • • • ® m2'^'^ ® 7^?°^ O • • • p^°^. Accordingly, the number of private 

qubits of is g^^^ = qv + Kqm + Qv) = Qv + Km + l)qM- Let A^Q^^ -pQOC denote the 

Hilbert spaces corresponding to the registers M and P, respectively. Take the Hilbert space OQ^^ 
corresponding to the qubits for oracle calls as OQ^*-^ = 7\/jQOC ^ -pQOC_ Accordingly, the number of 
qubits for oracle calls is q'o^"^ = qjvi + qv = {fn + l)qM- 

Consider each Vj, the jth quantum circuit of the verifier V of the original quantum fc-prover 
interactive proof system, which acts on V M-i • • • (g Aik- For each j, let {7*^*^^ be just the same 
unitary transformation as Vj and [/9^^ acts on WQ*-*"^ (^Ai^^^ • • • (g A^^^^, corresponding to that 
Vj acts onVCS)7Wi(8)---®A^A;- Define the verifier yQOC q£ ^^le corresponding quantum oracle circuit 
in the following way: 

• At the first transformation of yQO^^ yQOC £j,g^ applies U^^'^ , and then swaps the contents of 
Ml for those of M. 

• At the {{j - l)k + l)-th transformation of yQOC f^^, gg^^j^ 2 < j < m/2, yQOC g^g^ 

swaps the 

contents of M and P for those of and P^, respectively, then applies jj^'-''^ ^ and finally swaps 
the contents of Mi and Pi for those of M and P. 

• At the {{j - l)k + i)-th transformation of yQ^^ f^j. g^^j^ 2 < i < k,l < j < m/2, yQOC ^^.g^. 
swaps the contents of M and P for those of Mj_i and Pi-i, respectively, then swaps the contents 
of Mj and Pj for those of M and P. 

(i) In the case the input x of length n is in L: 

In the original m-message quantum /c-prover interactive proof system, there exist m-message 
(g;K, g-p)-restricted prior-unentangled quantum provers Pi, . . . , Pfc that cause V to accept x with 
probability at least a(n). Hence, if we let 0(j_i)fc+j for each 1 < i < k,l < j < m/2 he just the 
same unitary transformation as Pij (0(j_i)fc_(_j acts on 

0QOC ^ j^QOC (g, -pQOC corresponding 

to that Pjj acts on Aii (E>Vi), it is obvious that the probability of accepting x by V^'^"^ with 
access to O is exactly equal to the one the original V accepts it, which is at least a{n). 

(ii) In the case the input x of length n is not in L: 

Suppose that there were an oracle O' that makes the verifier yQO^ accept x with probability 
more than b{n). Consider m-message (gx, g'p)-restricted prior-unentangled provers P{,...,P^ 
of the original m-message quantum /c-prover interactive proof system such that, for each 1 < 
i < k,l < j < m/2, Plj is just the same transformation as 0'^j_-^^^j^_^- {Plj acts on M.i (g) Pj 
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corresponding to that O'^j^i^i^^i acts on A^'^oc ^ pQOC^^ gy ^jjgjj. construction, it is obvious 
that the probabiUty with which these provers P{ , . . . , can convince the verifier V is exactly 
equal to the one with which the oracle O' can, which is more than b{n). This contradicts the 
assumption. 

□ 

The inclusion QMIP'-'^'''-' C QOC immediately follows from Lemma [TBI Thus we have the following 
theorem. 

Theorem 17 QMIP(° <' ) = QOC = NEXP. 

6 Conclusions and Open Problems 

This paper analyzed the power of quantum multi-prover interactive proof systems and gave the NEXP 
upper bound for them in the cases that provers share at most polynomially many prior-entangled 
qubits. In particular, if provers do not share any prior entanglement with each other, the class of 
languages having quantum multi-prover interactive proof systems was shown equal to NEXP. Related 
to these, if a prover does not have his private qubits, the class of languages having quantum single- 
prover interactive proof systems was also shown equal to NEXP. 

A number of interesting problems remain open regarding quantum interactive proof systems. 

• We know very little about the power of general quantum multi-prover interactive proof systems 
with provers sharing arbitrarily many prior-entangled qubits. Can exponentially many prior- 
entangled qubits among provers help a quantum verifier to verify a language not in NEXP? 
Does NEXP have quantum multi-prover interactive proof systems with prior-entangled provers? 

• Probabilistic oracle machines are closely related to the theory of probabilistic checkable proofs 
12]. How is the relation between the quantum oracle circuits introduced in this paper and possible 
quantum analogues of probabilistic checkable proofs? 

• In the classical setting the power of one-message multi-prover interactive proof systems obviously 
remains same as that of one-message single-prover ones. However, as Kobayashi, Matsumoto, 
and Yamakami [211 noticed, it might not be so in the quantum setting. How is the power of 
one-message quantum multi-prover interactive proof systems (both in the cases with and without 
prior entanglement)? 
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Appendix 

A Proof of Theorem 1141 

It is known that every language in NEXP has a (classical) multi-prover interactive proof system, in 
particular, a one-round two-prover classical interactive proof system with exponentially small one- 
sided error Under the assumption that provers do not share any prior entanglement with each 
other, it is easy to show that a quantum verifier can successfully simulate such a classical one-round 
two-prover protocol (cf. 112] ) . 

Proof of Theorem \14\ Given a classical fe-prover interactive protocol, consider such a quantum fc-prover 
protocol without prior entanglement that a quantum verifier performs measurements in {|0),|1)} 
basis on every qubit of his part at every time he sends questions to quantum provers and at every 
time he receives responses from them, and for the rest part of computation the quantum verifier 
behaves in the same manner as the classical verifier does. Such a protocol can be simulated without 
intermediate measurements by only using unitary transformations ^120]. Furthermore, since there is 
no prior entanglement among private qubits of the quantum provers, such a quantum protocol makes 
no difference from a classical protocol in which a classical verifier chooses a set of k classical provers 
probabilistically at the beginning of the protocol. Therefore, in such a quantum /c-prover protocol, for 
every input, the quantum provers can be only as powerful as the classical provers, i.e., the quantum 
provers can behave just in the same way as the classical provers do, while no set of k quantum provers 
can convince the quantum verifier with probability more than the maximum probability with which a 
set of k classical provers can convince the classical verifier. 

Now we explain in more detail. Let L be a language in NEXP, then L has a one-round two-prover 
interactive proof system. Let V be the classical verifier of this one-round two-prover interactive proof 
system. We construct a two-message quantum two-prover interactive proof system by just simulating 
this classical protocol. 

Assume that, just after the classical verifier V has sent questions to the provers Pi and P2, the 
contents of V^s private tape, the question to Pi, and the question to P2 are v, qi, and q2, respectively, 
with probability p{v,qi,q2)- Our two-message quantum verifier prepares the quantum registers 
V, Qi, Q2, Ai, and A2 among his private qubits. first stores v, qi, and q2 in V, Qi, and Q2, 
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respectively, then copies the contents of each Qj to the message qubits shared with a quantum prover 
p^(Q) y(Q) prepares the superposition 

{Vpiv,qi,q2) \v) \qi) ks) |0) |0) |gi) |0> jgs) |0)), 
'"'l^'l'^ V Qi Q2 Ai A2 Ml Pi M2 P2 

where, for each i = 1,2, Mj denotes the quantum register that consists of the message qubits between 
V^^^ and P/'*^'*, and denotes the quantum register that consists of P^^^^s private qubits. 

Next the quantum provers pj^^^ and P2^^ ^PPty some unitary transformations on their qubits. 
Now the state becomes 

V Qi Q2 Ai A2 

^ ^ Qi (gi , Qi ) J ai ) J V'l (gi , ai ))J ® 02 (g2 , Q2 ) J Q2 ) j V^2 (^2 , ^2 ) )) | 
Ml Pi "2 M2 P2 

Y (Vp(^> qi,Q2)ai{qi, ai)a2{q2, 02) 

1,(12 

X \v) \qi) \q2) |0) |0) |qi) |V'i(gi, qi))^ [02) jV'2(g2, a2))) , 



v,qi,q2,ai,a2 



V Qi Q2 Ai A2 Ml Pi M2 



where each ai{qi,ai) denotes the transition amphtude and each \ipi{qi,ai)) is a unit vector in the 
private space of pI'^\ 



FinaUy, copies the contents of tlie message qubits shared with the quantum prover p/«' to 

Aj to have the following state 

( qi,q2)ai{qi,ai)a2{q2, 02) \v) \qi) \q2) \ai) |a2) \ai) |V^i(gi, ai))^ [02) |V'2(g2, a2))J , 

'''''^'^^'"i'"^ ^^^^^^^ p^ p^ ' 

and does just the same computation as the classical verifier V using V, Mi and M2. V^^^ accepts 
the input if and only if V accepts it. 

(i) In the case the input x of length n is in L: 

The quantum provers have only to answer in just the same way as the classical provers do, and 
V^^^ accepts x with probability 1. 

(ii) In the case the input x of length n is not in L: 

Since no quantum interference occurs among the computational paths with different 4-tuple 
{qi,q2,ai,a2), and from the fact that any pair of classical provers cannot convince the classical 
verifier with probability more than 1/2 (actually 1/2"), it is obvious that, for any pair of quantum 
provers, F*^^) accepts x with probability at most 1/2 (actually 1/2"). 

□ 
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